Add a security object for file uploads like so:
class FileSecure
{
public resource $Allowed;
private object $Info;
public function __construct($allow)
{
$this->Allowed = $allow;
$this->Info = new finfo();
}
public function Check($file) : bool
{
if(in_array($fileType = $this->Info->file($file, FILEINFO_MIME_TYPE, $this->Allowed))) { return true; } else { return false; }
}
}
$fileCheck = array(
'Image' => new FileSecure(['image/bmp', 'image/gif', 'image/jpeg', 'image/png']),
'Text' => new FileSecure(['text/plain']),
'Compressed' => new FileSecure(['application/zip', 'application/x-rar-compressed'])
);
Click here to view all the MIME name's to extensions
Then add a front-end form which allows file upload and just pass it through this object before use of the uploaded file.
// note it must exist on the server before checking
if(!$fileCheck['Image']->Check($filename)):
// delete the file
endif;
You could use the Database to hold file locations or just have a default upload directory on your server and iterate through the files held within that directory.